Privacy Policy

1. What we collect

When you sign in, we collect your name and email address via Google OAuth (provided by Supabase Auth). We also store content you provide: your CV, target roles, salary preferences, location, work preferences, phone number, LinkedIn URL, and career narrative. Job descriptions you submit for evaluation are processed by the Anthropic API and stored with your evaluation report. If you use the Mock Interview feature, your answers and AI-generated scores and feedback are stored against your account. If you use Auto-Apply, we store encrypted portal credentials (employer login email and password) using AES-256-GCM encryption to submit job applications on your behalf. We do not store payment card details — all payment processing is handled by DodoPayments.

2. How we use your data

Your CV and profile are sent to the Anthropic API to generate job evaluations, tailored CV drafts, cover letters, and LinkedIn profile audits on your behalf. Your profile data (name, email, phone, work authorization) is used by our Auto-Apply engine to fill and submit job application forms at your explicit instruction. Your email is used to send job alert digests (via Resend) and Auto-Apply status notifications. We do not sell, rent, or share your personal data with third parties for marketing purposes.

3. Third-party services

Elsa uses the following third-party services, each with their own privacy policies:

• Supabase — authentication and session management
• Railway / PostgreSQL — database hosting
• Anthropic — AI evaluation, CV tailoring, cover letters, and LinkedIn audits
• DodoPayments — subscription billing
• Resend — transactional email delivery
• Vercel — application hosting
• Serper.dev — Google job search results for the scanner

4. Auto-Apply and portal credentials

The Auto-Apply feature submits job applications on your behalf using credentials you provide for employer job portals (e.g. Greenhouse, Ashby, Lever, Workday). These credentials are encrypted at rest using AES-256-GCM and are used solely to authenticate and submit applications at your explicit instruction. We do not share these credentials with any third party. You can delete stored credentials at any time from your profile.

5. Cookies

We use cookies strictly for authentication and to track onboarding completion. We do not use tracking cookies or third-party advertising cookies.

6. Data retention

Your data is retained for as long as your account is active. You may request deletion of your account and all associated data at any time by emailing us. We will action deletion requests within 30 days.

7. Contact

Questions about this policy? Email us at hello@elsa.jobs.